Revert forcing Passkeys / Improve upon creating a user in the Contao Manager

[zoglo]

Description

Version 1.10.0 of the Contao Manager introduced Passkey support, this however does not explain that Passkeys are used at all.

Issue

When creating an account , I expect to add a password, this however has been moved into a dropdown being invisible (inside a button).

It should most likely also not be named Use password for login but something like Use password for account creation. We aren't logging in nowhere, the button in the dropdown suggests otherwise.

Passkeys also don't work in an insecure context (when installing it locally using XAMPP, MAMPP, symfony serve --no-tls etc.).

Proposal

Make it a two-step process:

1. Type in your username
2. Be asked if you want to create a password or a passkey

---

Miscellaneous

I once got credentials for the Manager that were sent like this which will obviously not work as people don't know about the user creation as that is a new feature that hasn't been documented properly / users knowing Contao for years do not know about it. Anybody can guess what I thought.

"Username: Admin"
"Password: Passkey (Admin)"

Miscellaneous 2

If I am tasked as an employee to prepare a Contao on some random hoster for a client, I shouldn't be the one that creates an admin account using a passkey as it would be tied to my machine, hence why that option should be selectable.

[aschempp]

I disagree with several points, but I sure to think this can and should be improved.

I do think passkeys should be default and "enforced" since they are more secure. There is no reason not to use a passkey, except if your computer does not support it. The Contao Manager uses browser APIs to detect that, but apparently they are unstable or unreliable. As far as I remember, it should work in insecure context on localhost, but you should not be prompted for a passkey without HTTPS on a regular website by the Contao Manager.

Regarding random hoster for client installation, you still should use passkeys for that. Either share the passkey using an appropriate corporate password manager, or invite your employees/colleagues to create their own local passkey. The Contao Manager has user management built in just for that.

I do like the idea of a two-step process or someting similar, as this could work around the browser detection issues.